A vulnerability scan runs automated checks based on known patterns. A manual pentest combines this baseline with creative approaches, tailored attack chains, and context about your specific environment. This produces realistic scenarios that automated tools alone cannot replicate.

At least annually. In addition, after significant changes such as new applications, major releases, cloud migrations, or new AI solutions. For particularly critical systems, a shorter cycle may be appropriate.

Both are possible. By default, you receive clear, risk-based reporting. If desired, we support implementation, the remediation roadmap, and technical hardening. Including a retest.

A penetration test assesses defined systems within a limited time frame. The goal is a comprehensive vulnerability analysis with documented findings. Red teaming simulates a real attack over weeks without a defined scope, based on actual attacker profiles. The goal is not full coverage, but proof of whether an attacker can reach a business-critical objective. If you want to know where vulnerabilities are, you need a pentest. If you want to know whether your detection and response work in an incident, you need red teaming.

TLPT is a regulatory requirement for certain financial institutions under DORA. For everyone else, the principle is still relevant: threat-led penetration testing aligns attack simulations with real threat profiles, not generic checklists. Organizations that operate critical infrastructure or work in regulated industries benefit from the same approach without a formal TLPT obligation.

Offensive Security does not have to be treated as a one-off project. Penetration tests can be limited to individual releases or new features. Attack simulations can run in parallel with operations. During scoping, we define together which approach fits your development cycles without interrupting operations.

A penetration test finds vulnerabilities. An attack simulation tests whether your detection and response mechanisms identify those vulnerabilities and respond correctly. Ransomware behavior, command-and-control traffic, and data exfiltration are replicated under controlled conditions. The key question is not only: Is there a gap? But: Would your SOC notice an attack through it?

That depends on the objective. Unannounced campaigns deliver more realistic results on the organization’s actual maturity level. Announced campaigns have a stronger awareness effect. Both are possible and legally permissible if the framework conditions are clearly defined. We clarify this during scoping together with your HR and legal departments.

Every engagement starts with a defined scoping document: target systems, exclusions, time windows, points of contact, and emergency processes. We work exclusively within the agreed framework. Findings are transmitted in encrypted form and are not communicated via insecure channels. Confidentiality is governed contractually.

Yes. DORA requires regular resilience testing for certain financial institutions, including TLPT under TIBER-EU. NIS-2 expects technical security testing as part of risk management. ISO 27001 requires evidence that implemented controls have been tested for effectiveness. Our reports are audit-proof and aligned with the evidence requirements of the respective regulations.

The report prioritizes findings by risk and provides concrete countermeasures. If desired, we support implementation, verify measures in a retest, and derive a security roadmap from the results. Technical measures are implemented by our defense team. Findings with governance or compliance relevance flow directly into your ISMS and your evidence documentation for ISO 27001, NIS-2, and DORA. Offensive, defense, and governance work in a continuous cycle at carmasec.